Quantum secret sharing between multi-party and multi-party without entanglement 
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We propose a quantum secret sharing protocol between multi-party (m members in group 1) and 
multi-party (n members in group 2) using a sequence of single photons. These single photons are 
used directly to encode classical information in a quantum secret sharing process. In this protocol, all 
members in group 1 directly encode their respective keys on the states of single photons via unitary 
operations, then the last one (the m th member of group 1) sends 1/n of the resulting qubits to each 
of group 2. Thus the secret message shared by all members of group 1 is shared by all members of 
group 2 in such a way that no subset of each group is efficient to read the secret message, but the 
entire set (not only group 1 but also group 2) is. We also show that it is unconditionally secure. 
This protocol is feasible with present-day techniques. 

PACS numbers: 03.67.Dd, 03.67.Hk, 89.70,+c 



I. INTRODUCTION 

Suppose two groups such as two government depart- 
ments, where there are m and n members respectively, 
want to correspond with each other, but members of each 
group do not trust each other. What can they do? Clas- 
sical cryptography gives an answer which is known as 
secret sharing p). It can be used, to guarantee that no 
single person or part of each department can read out 
the secret message, but all members of each group can. 
This means that for security to be breached, all peo- 
ple of one group must act in concert, thereby making it 
more difficult for any single person who wants to gain 
illegal access to the secret information. It can be im- 
plemented as follows: from his original message, every 
person ( called sender) of group I separately creates n 
coded messages and sends each of them to each mem- 
ber (called receiver) of group 2. Each of the encrypted 
message contains no information about senders' original 
message, but the combination of all coded messages con- 
tains the complete message of group 1. However, either 
a (m + n + I)-th party (an "external" eavesdropper) or 
the dishonest member of two groups who can gain ac- 
cess to all senders' transmissions can learn the contents 
of their (all senders) message in this classical procedure. 
Fortunately, quantum secret sharing protocols @,H,Q,|^ 
can accomplish distributing information securely where 
multi-photon entanglement is employed. Recently, many 
kinds quantum secret sharing with entanglement have 
been proposed 0, 0, H, 0, E3 ■ Lance et al. have reported 
an experimental demonstration of a (2,3) threshold quan- 
tum secret sharing scheme The combination of 
quantum key distribution (QKD) and classical sharing 
protocol can realize secret sharing safely. Quantum se- 
cret sharing protocol provides for secure secret sharing by 
enabling one to determine whether an eavesdropper has 
been active during the secret sharing procedure. But it 



is not easy to implement such multi-party secret sharing 
tasks 3- El ! since the efficiency of preparing even tripar- 
tite or four-partite entangled states is very low [l2L Il3| , 
at the same time the efficiency of the existing quantum 
secret sharing protocols using quantum entanglement can 
only approach 50%. 



More recently, a protocol for quantum secret sharing 
without entanglement has been proposed by Guo and 
Guo They present an idea to directly encode the 

qubit of quantum key distribution and accomplish one 
splitting a message into many parts to achieve multi- 
party secret sharing only by product states. The theoret- 
ical efficiency is doubled to approach 100%. Bradler and 
Dusek have given two protocols for secret-information 
splitting among many participants |l5j . 



In this paper, we propose a quantum secret sharing 
scheme employing single qubits to achieve the aim men- 
tioned above — the secret sharing between multi-party 
(m parties of group 1) and multi-party (n parties of group 
2). That is, instead of giving his information to any one 
individual of group f , each sender to split his informa- 
tion in such a way that no part members of group f or 
group 2 have any knowledge of the combination of all 
senders (group I), but all members of each group can 
jointly determine the combination of all senders (group 
I). The security of our scheme is based on the quantum 
no-cloning theory just as the BB84 quantum key distri- 
bution. Comparing with the efficiency 50% limiting for 
the existing quantum secret sharing protocols with quan- 
tum entanglement, the present scheme can also be 100% 
efficient in principle. 
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II. QUANTUM KEY SHARING BETWEEN 
MULTI-PARTY AND MULTI-PARTY 

Suppose there are m (m > 2) and n (n > 2) mem- 
bers in government department 1 and department2, re- 
spectively, and Alicel, Alice2, Alicem, and Bobl, 
Bob2, • • • , Bobn are their respective all members, m 
parties of department 1 want quantum key sharing with 
n parties of department2 such that neither one nor part 
of each department knows the key, but only by all mem- 
bers' working together can each department determine 
what the string (key) is. In this case it is the quantum 
information that has been split into n pieces, no one of 
which separately contains the original information, but 
whose combination does. 

Alicel begins with A\ and B\, two strings each of nN 
random classical bits. She then encodes these strings as 
a block of nN qubits, 

where a\ is the k th bit of A\ (and similar for B\) and 
each qubit is one of the four states 
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The effect of this procedure is to encode A\ in the basis 
Z = {|0>, |1)} or X = {|+), |-)}, as determined by B 1 . 
Note that the four states are not all mutually orthogonal, 
therefore no measurement can distinguish between all of 
them with certainty. Alicel then sends l^ 1 ) to Alice2 
over their public quantum communication channel. 

Depending on a string A 2 of nN random classical bits 
which she generates, Alice2 subsequently applies a uni- 
tary transformation <7 = I = |0)(0| + |1)(1| (if the k th 
bit a\ of A 2 is 0), or u x = ia y = |0)(1| - |1)(0| (if a\ = 1) 
on each IV'ci 1 6 1 ) °f the nN qubits she receives from Al- 
icel such that \ip a i b ^) is changed into \ip® 2b i), and ob- 
tains nTV-qubit product state |* 20 ) = ®£fi|^°2 6 i). Af- 



ter that, she performs a unitary operator / (if b\ 
or H 



0) 

71 (|0) + |1))(0| + ^ (|0) - |1))(1| (if b\ = 1) on 

each qubit state \ip° 2 ,i ) according to her another random 

a k°k 

classical bits string B 2 , and makes \tb° 2hl ) to be turned 

a k°k 

into |Vv& 2 )- Alice2 sends Alice3 |* 2 ) = (g^-jVVb 2 )- 
Similar to Alice2, Alicc3 applies quantum operations on 
each qubit and sends the resulting nN qubits to Alice4. 
This procedure goes on until Alicem. 

Similarly, Alicem first creates two strings A m and B m 
of nN random classical bits. Then she makes a unitary 



operation <to (if a™ = 0) or a\ (if a™ = 1) on each 
qubit state |^» m-i 6 m-i). It follows that |^» m-i 6 m-i) is 

changed into |^ mfcm _ 1 ). After that she applies oper- 



ator I (if bf = 0) or H (if b™ 

ing qubit state |^ mi ,m-i) such that \ip® mhm -i) is turned 



1) on the result- 

<K 



into \tpa m b m )- Alicem sends iV-qubit product states 

i*n = <=Viv^ +1 ^ +1 >, m) = CoV« +2 )> 

■". I*n> - CoVa™ + „^ + J of the resulting nN- 
qubit state |* m ) = ®l= 1 \il) a fbf) to Bobl, Bob2, 
Bobn, respectively. 

When all Bobl, Bob2, • • • , and Bobn have announced 
the receiving of their strings of N qubits, Alicel, Al- 
ice2, • • • , and Alicem publicly announce the strings B\, 
B2, and B m one after another, respectively. Note 
that B\ , B2 , • • • , and B m reveal nothing about At 
(i = 1, 2, • • • , m), but it is important that all Alicel, Al- 
ice2, • • • , and Alicem not publish their respective B\, B 2 , 
• • • , and B m until after all Bobl, Bob2, • • • , and Bobn 
announce the reception of the N qubits Alicem sends to 
them. 

Bobl, Bob2, • • • , and Bobn then measure each qubit 
of their respective strings in the basis X or Z accord- 
ing to the XOR result of corresponding bits of strings 
Bi, B 2 , B m . Since the unitary transformation 

u\ = i(T y flips the states in both measuring bases such 
that ai\0) = <Ti|l) = |0), ai\+) = R and 

<j\\— ) = — 1+), i.e. I,i<J y leave bases X and Z unchanged, 
but H turns |0), |1), |+) and |-) into |+>, |->, |0) and 
|1), respectively, i.e. H changes bases X and Z 1 so if 



=2°k 



) b™ = 0, then \ip a m b m ) should be 

h L — 1 
=2°fc — J-) 



measured in the same basis with IVVfe 1 )' if 
\ib a m b m ) should be measured in the basis different from 

1 ' k k 1 

|^ a i b i), where the symbol ® is the addition modulo 2. 
Therefore, if ®iL 2 b\ — b\, iV'a^b™) is measured in the Z 
basis, otherwise in the basis X. That is, if ©™ l^nj+z = 0, 
then Bob/ measures \ipa m . +l b m . +l ) in the basis Z, oth- 
erwise, he measures in the basis X. Moreover, after 
measurements, Bob? can extract out all Alices's encod- 
ing information ®^L 1 d' n j +l , j = 0, 1, 2, • • • , TV - 1, for 
I = 1, 2, • • • , n. 

Now all Alices and Bobs perform some tests to 
determine how much noise or eavesdropping happened 
during their communication. Alicel, Alicc2, and 
Alicem select some bits nj r + I (of their nN bits) at 
random, and publicly announce the selection. Here 

jr € {jl,j 2 , • • • ,jr } C {jl,j 2 , ■ ■ ■ ,jr )jVo + li • • • Jn} = 

{0,1,2,..., N - 1}, and I = 1,2,..., n. All Bobs 
and all Alices then publish and compare the val- 
ues of these checked bits. If they find too few the 
XOR results ©™ 

i a nj r +i °t the corresponding bits 
, of these checked bits of all Alices and the 
values of Bob/'s checked bits \ip a ™. +l b™ ,) agree, 
then they abort and re-try the protocol from the 
start. The XOR results ef =1 (e^ 1 < js+/ ) of BobZ's 
corresponding bits ® r ^L 1 a l n - s+l of the rest unchecked 
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bits nj s + I of {®T =l < 1+1 }^\ {©£i< i+2 }f=o\ 
{®T=i< j+n }fjo (or ®jL _ o 1 |^ +1 6 S+1 >, 
®f=oVa™ +2 ^ +2 ), can be 

used as raw keys for secret sharing between all Alices 
and all Bobs, where j s = j ro+ i,j ro+2 , . . -Jn- 

This protocol is summarized as follows: 

Ml. Alicel chooses two random niV-bit strings A\ 
and B\. She encodes each data bit of A\ as {|0), |1)} if 
the corresponding bit of B\ is or {|+), |— )} if B\ is 1. 
Explicitly, she encodes each data bit ( 1 ) of A\ as |0) 
( |1) ) if the corresponding bit of B\ is or |+) ( |— ) ) 
if the corresponding bit of Si is 1, i.e. she encodes each 
bit a\ of A\ as \ip a i b i) 01 Eqs.JSJ)-©, where b\ is the 
corresponding bit of B±. Then she sends the resulting 
nA-qubit state I* 1 ) = ^fef^VVfei) to Alice2. 

M2. Alice2 creates two random nTV-bit strings A 2 and 
B 2 . She applies cto or a% to each qubit \ij; a i b i) of nN- 
qubit state l^ 1 ) according to the corresponding bit of A 2 
being or 1, then she applies J or H to each qubit of the 
resulting nA-qubit state depending on the corresponding 
bit of B 2 being or 1. After this, she sends Alice3 the 
resulting nA-qubit state | V I /2 ). 

M3. Alicei does likewise, i = 3,4, ••• , m — 1. De- 
pending on the corresponding bit a™ of a random niV-bit 
string Am, which she generates on her own, Alicem per- 
forms (To (if a™ = 0) or u\ (if a™ = 1) on each qubit of 
\^ m ~ x ). According to a random bit string B m which she 
generates, she subsequently applies I (If the correspond- 
ing bit b™ of B m is 0) or H (if bj™ = 1) on each qubit 
of the resulting nA-qubit state |^ m0 ), which results in 
nA-qubit state |* m ) = ®]J= 1 |V'<i£»bjj>). After it; she sends 
7V-qubit state ©^IVv™ b m . > to Bob?, 1 < I < n. 

M4. Bobl, Bob2, Bobn receive N qubits, and 
announce this fact, respectively. 

M5. Alicel, Alice2, • • • , and Alicem publicly announce 
the strings B\, B 2 , • • • , and B m , respectively. 

M6. Bobl, Bob2, • • • , and Bobn measure each qubit of 
their respective strings in the basis Z or X according to 
the XOR results of corresponding bits of strings B\, B 2 , 
• ■ • , B rn . That is, Bob/ measures \ipa m . b m . ) in the basis 

Z (if ®T=iK ]+l = 0) or in the basis JT(if ffi™ = 1), 

j = 0,1,.-. ,N-1, 1 = 1,2,.-. ,n. 

M7. All Alices select randomly a subset that will serve 
as a check on Eve's interference, and tell all Bobs the 
bits they choose. In the check procedure, all Alices and 
Bobs are required to broadcast the values of their checked 
bits, and compare the XOR results of the corresponding 
bits of checked bits of A\ , A 2 , • • • , A m and the values 
of the corresponding bits of Bobl, Bob2, • • • , and Bobn. 
If more than an acceptable number disagree, they abort 
this round of operation and restart from first step. 

M8. The XOR results ®i =1 {®T=i< ]s +i) of BoW's 
corresponding bits ® m . 1 a l n j s+l of the remaining 
bits nj s + I of {8|l 1 4 J . +1 }f =0 1 , {mi<j+2}f=o\ 
{®T=i< j+ n}fjo (or ^'li^^j, 



®f=oVa™ +2 b™ +2 ), ®f=oVa™ + „b™ + J) can be 

used as key bits for secret sharing between all Alices and 
all Bobs, where j s = j ra+1 ,j ro+2 , . . .,j N . 

For example, m = 2 and n — 3. Suppose 

M = {1,0,0,1,0,1,0,1,1,0,0,0,1,1,1,0,1,0} 

and Bi = {0,1,0,1,1,0,1,1,0,0,1,0,1,0,1,0,0,1} 
are two random 18-bit strings of Alicel. De- 
pending on Bi, then she encodes A\ as l^ 1 ) = 
|1)|+}|0)|-)|+)|1)|+)|-)|1)|0)|+)|0)|-)|1)|-)|0)|1)|+). 
If Alice2's two strings of random bits are 
A 2 = {1,1,1,0,0,1,1,1,0,0,0,1,0,1,1,0,0,1} and 
B 2 = {1,0,0,1,1,0,0,0,1,1,1,1,0,0,0,1,0,1}, she 
applies ia y to the I th , 2 th , 3 th , 6 th , 7 th , 8 th , 12 th , 
14 th , 15 th , 18 th qubits of I* 1 ), getting |* 20 ) = 
|0)|-)|1)|-)|+)|0)|-)|+)|1)|0)|+)|1)|-)|0)|+)|0)|1)|-), 
then she performs H on 1 th , 4 th , 5 th , 
9 th , 10 th , II th , 12 th , 16 th , 18 th qubits of 
|* 20 ), obtaining |* 2 ) = ^ij^j) 
|+)|-)|1)|1)|0)|0)|-)|+)|-)|+)|0)|-)|-)|0)|+)|+)|1)|1). 
After that, she sends the 6-qubit states 

l*i> = ^=ol^ +1 6l i+1 ) = 

\n) = ^ 5 =ol^. +2b | 3+2 ) = |-)|0)|+)|0)|0)|1), and 

1*1) = Of = o|^al, +3 6l J+ 3> = |1)|0)|-)|-)|+)|1) to Bobl, 

Bob2 and Bob3, respectively. When each of Bobl, Bob2 
and Bob3 has received 6-qubit state and announced the 
fact, Alicel and Alice2 publicly inform all Bobs their 
respective strings B\ and B 2 . Then Bob/ measures his 
qubit state |t/> a &g_ ( ) in the basis Z if blj +l ®b^ +l = 

or in basis X if bh +l ® b^j+i = 1> f° r 3 = 0, 1, • • • ,5, 
I = 1,2,3. From this, Bobl, Bob2 and Bob3 derive 
Alicel and Alice2's encoding information {0, 1, 1, 0, 1, 0}, 
{1,0,0,0,0,1} and {1,0,1,1,0,1} of their respective 
6-qubit states if no Eve's eavesdropping exists. If Alicel 
and Alice2 choose the 1 th , 2 th , 3 th : 13 th , U th , 15 th 
bits as the check bits, then the XOR results 1 © © 0, 
1 © © 1, © © 1, © 1 © 1 (or 1, 0, 1, 0) of the 
corresponding bits of Bobl, Bob2 and Bob3's remaining 
bits {1,1,0,0}, {0,0,0,1} and {0,1,1,1} are used as 
raw keys for secret sharing between two Alices and three 
Bobs. 

Note that B\, B 2 , • • • , and B m reveal nothing about 
Ai (i = 1, 2, • • • , to), but it is important that all Alicel, 
Alice2, • • • , and Alicem not publish their respective B\, 
B 2 , and B m until after all Bobl, Bob2, and 
Bobn announce the reception of the N qubits Alicem 
sends to them. If all Alices broadcast their respective B\ , 
B 2 , • • • , and B m before all Bobs announce the reception 
of the N qubits Alicem sends to them, then either a 
(rn + n + l)-th party (an "external" eavesdropper) or the 
dishonest member of two groups intercepts nN qubits 
state |^ m ) = ©fc^ilV'a^b™) can learn the contents of their 
(all senders) message in this procedure by measuring each 
qubit in the Z basis (if ffi™ \b % n ^ +l — 0) or in the X basis 

It is necessary for Alicei (2 < i < m) applying uni- 
tary operation H randomly on some qubits. Each sender 
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Alicei encoding string Bi on the sequence of states of 
qubits is to achieve the aim such that no one or part of 
Alicel, • • • , Alicem can extract some information of oth- 
ers. Case I: Alice2 does not encode a random string of 
/ and H on the sequence of single photons, Alicel can 
enforce the intercept-resend strategy to extract Alice2's 
whole information. Alicel can intercept all the single 
photons and measure them, then resend them. As the 
sequence of single photons is prepared by Alicel, Alicel 
knows the measuring-basis, and the original state of each 
photon. She uses the same measuring-basis when she 
prepared the photon to measure the photon, and read 
out Alice2's complete secret messages directly. Case II: 
Aliceio (3 < io < m) is the first one who does not encode 
a random string of I and H on the sequence of single pho- 
tons, then one of Alicel, Alice2, . . . , Alice(zo — 1) can also 
enforce the intercept-resend strategy to extract Aliceio's 
whole information by their cooperation. Without loss of 
generality, suppose that Alice2 intercepts all the parti- 
cles that Aliceio sends. Alice2 can obtain Aliceio's secret 
message if Alicel, Alice3, . . . , Alice(io — 1) inform her 
their respective strings B\, B%, ... , -Bi -i and A\, A3, 

. . . , A; _i. 

This secret sharing protocol between m parties and n 
parties is almost 100% efficient as all the keys can be used 
in the ideal case of no eavesdropping, while the quantum 
secret sharing protocols with entanglement states can 
be at most 50% efficient in principle. In this protocol, 
quantum memory is required to store the qubits which 
has been shown available in the present experiment tech- 
nique |lfi| . However, if no quantum memory is employed, 
all Bobs measure their qubits before Alicei's (1 < i < m) 
announcement of basis, the efficiency of the present pro- 
tocol falls to 50%. 

Two groups can also realize secret sharing by Alicel 
preparing a sequence of nN polarized single photons 
such that the n-qubit product state of each n photons 
is in the basis Z or X as determined by A-bit string 
Bi, instead that in the above protocol. For instance, 
(A) Alicei (1 < i < m) creates a random n A-bit 
string Ai and a random A-bit string Bi, and Alicel 
encodes her two strings as a block of nN qubits state 

1 ' J-^^-u-d+iV '^ a ™(j-i)+2V '^ a ™(j-i)+ n V 

where each qubit state \<fi a i b i) is one of |</>oo) = |0), 

I0io) = |1>, \<hi) = |+) J andVii> - I-)- Then 
Alicel sends l^ 1 ) to Alice2. Alicei (2 < i < m) 
applies Co or o\ to each qubit state |</> <-i m-i) 

(1 < I < n) according to the corresponding bit 
a »i(j-i)+2 °f ^2 being or 1, then she applies / (if 
bj = 0) or H (if 6* = 1) to each resulting qubit state 
l^ ; ,;). Alicem sends A qubits ®^i|0 a m bv) 

a n(j-l)+l 3 »W-1)+I i 

of the resulting nN qubits state |<E> m ) = 

\4>a m b m )\4>a m b m )---\4>a m b m ) to 

BobZ, 1 < I < n. After all Bobs receive their re- 
spective N qubits, Alicei announces Bi, then Bob/ 
measures each of his qubit states \<j) a m { . 1)+l bf) m 



the basis Z if ®™ =1 b ) = or I if ©™ y b) = 1, and 
deduces its value ®'iLia % n( j_ l s +l if there is no Eve's 
eavesdropping. A subset of {©^(ffi^a^-^^)}^ 
will serve as a check, passing the test, the unchecked 

bits of {©r=i(©™i< (i -i)+i)}f=i wiU take as the 

raw keys for secret sharing between two groups. (B) 
Alicei chooses two random A-bit strings Ai and 
Bi, and Alicel prepares a block of nN qubits state 
I* 1 ) = ^jLilAib^ai hO'-'IV'a 1 fci)> where a) t is 
or 1 and ©™ =1 aj ; = aj. Alicei applies unitary operation 
(To or 1 to each qubit state |Vy-V _1 ) depending 

on the j-th bit a* of Ai being or 1, following it, / 
or H according to Bi, to each particle. Bob/ mea- 
sures each of his particles IV^fe 1 ") in the basis Z (if 
0£L]6j = 0) or X (if ©^6} ="l). All Alices select 
randomly some bits and announce their selection. 
All Bobs and all Alices compare the values of these 
check bits. If the test passes, then the rest of the 
unchecked bits of {®Y=i( a ji © a| © • • • © af)}f =1 are 
the raw key for secret sharing between two groups. We 
should emphasize that n must be odd in case (B) since 

®r=i( a ); © a j © • • • © a f) = a ) ® na2 j ® ' ' " ® na T = a j if 
n is even. 



III. SECURITY 

Now we discuss the unconditional security of this quan- 
tum secret sharing protocol between m parties and n 
parties. Note that the encoding of secret messages by 
Alicei (1 < i < m) is identical to the process in a one- 
time-pad encryption where the text is encrypted with a 
random key as the state of the photon in the protocol is 
completely random. The great feature of a one-time-pad 
encryption is that as long as the key strings are truly se- 
cret, it is completely safe and no secret messages can be 
leaked even if the cipher-text is intercepted by the eaves- 
dropper. Here the secret sharing protocol is even more 
secure than the classical one-time-pad in the sense that 
an eavesdropper Eve can not intercept the whole cipher- 
text as the photons' measuring-basis is chosen randomly. 
Thus the security of this secret sharing protocol depends 
entirely on the second part when Alicem sends the l-th 
sequence of A photons to BoW (1 < I < n). 

The process for ensuring a secure block of nN qubits 
(n secure sequences of N photons) is similar to that in 
the BB84 QKD protocol [l7| ■ The process of this secret 
sharing between m parties and n parties after all Alices 
encoding their respective messages using unitary opera- 
tions is in fact identical to n independent BB84 QKD 
processes, which has been proven unconditional secure 
[l^lliij- Thus the security for the present quantum secret 
sharing between multi-party and multi-party is guaran- 
teed. 

In practice, some qubits may be lost in transmitting. 
In this case, all Alices and Bobs can take two kind 
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strategies, one is removing these qubits, the other is 
using a qubit chosen at random in one of four states 
{|0), |1), |+), |— )} as a substitute for a lost qubit. If a 
member does not receive a qubit and wants to delete it, 
she/he must announce and let all members in the two 
groups know the fact. All Alices and all Bobs sacrifice 
some randomly selected qubits to test the "error rate". 
If the error rate is too high, they abort the protocol. 
Otherwise, by utilizing a Calderbank-Shor-Steane (CSS) 
code [lSl l20l l2ll | . they perform information reconciliation 
and privacy amplification on the remaining bits to obtain 
secure final key bits for secret sharing. They proceed 
to this step obtaining the final key while all Alices 
communicate with all Bobs. In a CSS mode, classical 
linear codes C\ and are used for bit and phase 
error correction, respectively, where C2 C C\. The best 
codes that we know exist satisfy the quantum Gilbert- 
Varshamov bound. The number of cosets of C2 in C\ is 
I C]_ I / 1 C 2 1 = 2 M so there is a one-to-one correspondence 
Uk — > K of the set of representatives uk of the 2 M cosets 
of C2 in C\ and the set of M-bit strings K. As in the 
BB84 protocol, C\ is used to correct bit errors in the key, 
and Ci to amplify privacy. For the sake of convenience, 
we suppose that after verification test all Alices are 
left with the N' bit string v = {0f =1 (0£L i< +! ), 

{©[Li(©™i a L+i)}f=i: but a11 Bobs with " + £ by 
the effect of losses and noise. Let us assume that a priori 
it is known that along the communication channel used 
by all Alices and all Bobs, the expected number of errors 
per block caused by losses and all noise sources including 
eavesdropping is less than t = 6N', where 5 is the bit 
error rate. How can an upper bound be placed on t? In 
practice, this can be established by random testing of the 
channel, leaving us with a protocol which is secure |22j . 
even against collective attacks. If 5 is low enough, we can 
be confident that error correction will succeed, so that 
all Alices and all Bobs share a secure common key. The 
secure final key for secret sharing can be extracted from 
the raw key bits (consisting of the remaining noncheck 
bits) at the asymptotic rate R = Max{l - 2H(8), 0} [2^ . 
where 6 is the bit error rate found in the verification 
test (assuming 5 < 1/2). Using a pre-determined t 
error-correcting CSS code [l^ . the two groups share 
a secret key string and realize secure communication. 
Suppose that government department 1 wishes to send 
messages to government department2, then all Alices 
gather together, choose a random code word u in C\ (u 



may be u\ + u% + • • • + u m , where Ui is a code word in 
C\ selected randomly by Alicei), and encode their M-bit 
message P by adding the message and the M-bit string 
K together, where u + C2 = Uk + C2, then they send 
it to government department2. Bobs receive the secret 
message and publicly announce this fact. All Alices 
announce u + v. All Bobs subtract this from their result 
v + e, and correct the result u + e with code C\ to obtain 
the code word u. All Alices and all Bobs use the M-bit 
string K as the final key for secret sharing. That is, all 
Alices and all Bobs perform information reconciliation 
by the use of the classical code C\ , and performs privacy 
amplification by computing the coset of u + C2 ■ All Bobs 
can decode and read out the message P by subtracting 
K. No one in department 1 tells final key K to someone 
or part of department2, since the aim of all Alice is to 
let all Bobs know their message. 

In summary, we propose a scheme for quantum secret 
sharing between multi-party and multi-party, where no 
entanglement is employed. In the protocol, Alicel pre- 
pares a sequence of single photons in one of four different 
states according to her two random bits strings, other 
Alicei (2 < i < m) directly encodes her two random 
classical information strings on the resulting sequence 
of Alice(i — 1) via unitary operations, after that Alicem 
sends 1 /n of the sequence of single photons to each Bob/ 
(1 < I < n). Each Bob/ measures his photons according 
to all Alices' measuring-basis sequences. All Bobs must 
cooperate in order to infer the secret key shared by all 
Alices. Any subset of all Alices or all Bobs can not ex- 
tract secret information, but the entire set of all Alices 
and the entire set of all Bobs can. As entanglement, espe- 
cially the inaccessible multi-party entangled state, is not 
necessary in the present quantum secret sharing protocol 
between m-party and n-party, it may be more applicable 
when the numbers m and n of the parties of secret shar- 
ing are large. Its theoretic efficiency is also doubled to 
approach 100%. This protocol is feasible with present- 
day techniques. 
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